wa[.]audios-whatapp[.]hl[.]cn

The domain wa.audios-whatapp.hl.cn was registered on July 28, 2026 through the registrar 万商云集（成都）科技股份有限公司. It resolves to the IPv4 address 192.197.113.111 and is served by the authoritative name servers ns1.kenpains.com and ns2.kenpains.com. VirusTotal has recorded 18 of 91 scanned security vendors flagging the domain as malicious, indicating a consensus of detection across multiple scanners. The domain is currently listed on two public blocklists and is explicitly blocked by the PhishDestroy and OpenPhish feeds, both of which classify it as a generic phishing infrastructure.

The threat is assessed as high risk and remains active as of the report date, August 05, 2026. Public evidence does not yet include a page title, SSL certificate details, HTTP response codes, or Safe Browsing verdict beyond the blocklist entries. Consequently, the exact content hosted on the domain cannot be confirmed, and the specific lure or credential‑capture technique remains uncertain. Nonetheless, the combination of recent registration, rapid appearance on phishing blocklists, and multiple vendor detections aligns with typical patterns of newly‑operated phishing campaigns.

Defenders should add wa.audios-whatapp.hl.cn to network deny lists and block outbound connections to 192.197.113.111 at the firewall level. Security monitoring solutions should ingest the blocklist identifiers from PhishDestroy and OpenPhish to ensure timely detection of any attempted connections. Continuous re‑scanning of the domain on VirusTotal and periodic checks of the hosting infrastructure are recommended to capture any evolution of the campaign. Organizations that use email or messaging services should be aware of the generic phishing label and educate users to verify unexpected communications that reference WhatsApp or audio services, as the domain name suggests a possible impersonation vector.